{"id":"CVE-2026-15410","kind":"vulnerability","aliases":["CVE-2026-15410"],"related":[],"title":"Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in…","description":"SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"SonicWall SMA1000 appliances contain a code injection flaw that, under specific conditions, lets a remote attacker who is already authenticated as an administrator run arbitrary OS commands on the appliance. CISA lists it as known exploited in the wild and tagged ransomware-related.","severity":"high","cvss":7.2,"epss":null,"exploited":true,"exploited_at":"2026-07-14T00:00:00+00:00","products":[{"name":"SonicWall SMA1000 Appliances","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"sonicwall sma6210 firmware","fixed":[],"affected":"= 12.4.3-03245","ecosystem":"vendor"},{"name":"sonicwall sma6210 firmware","fixed":[],"affected":"= 12.4.3-03387","ecosystem":"vendor"},{"name":"sonicwall sma6210 firmware","fixed":[],"affected":"= 12.4.3-03434","ecosystem":"vendor"},{"name":"sonicwall sma6210 firmware","fixed":[],"affected":"= 12.5.0-02283","ecosystem":"vendor"},{"name":"sonicwall sma6210 firmware","fixed":[],"affected":"= 12.5.0-02624","ecosystem":"vendor"},{"name":"sonicwall sma6210 firmware","fixed":[],"affected":"= 12.5.0-02800","ecosystem":"vendor"},{"name":"sonicwall sma7210 firmware","fixed":[],"affected":"= 12.4.3-03245","ecosystem":"vendor"},{"name":"sonicwall sma7210 firmware","fixed":[],"affected":"= 12.4.3-03387","ecosystem":"vendor"},{"name":"sonicwall sma7210 firmware","fixed":[],"affected":"= 12.4.3-03434","ecosystem":"vendor"},{"name":"sonicwall sma7210 firmware","fixed":[],"affected":"= 12.5.0-02283","ecosystem":"vendor"},{"name":"sonicwall sma7210 firmware","fixed":[],"affected":"= 12.5.0-02624","ecosystem":"vendor"},{"name":"sonicwall sma7210 firmware","fixed":[],"affected":"= 12.5.0-02800","ecosystem":"vendor"},{"name":"sonicwall sma8200v","fixed":[],"affected":"= 12.4.3-03245","ecosystem":"vendor"},{"name":"sonicwall sma8200v","fixed":[],"affected":"= 12.4.3-03387","ecosystem":"vendor"},{"name":"sonicwall sma8200v","fixed":[],"affected":"= 12.4.3-03434","ecosystem":"vendor"},{"name":"sonicwall sma8200v","fixed":[],"affected":"= 12.5.0-02283","ecosystem":"vendor"},{"name":"sonicwall sma8200v","fixed":[],"affected":"= 12.5.0-02624","ecosystem":"vendor"},{"name":"sonicwall sma8200v","fixed":[],"affected":"= 12.5.0-02800","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","ransomware","self-hosted","sma1000","sonicwall","vpn-gateway"],"not_affected_if":["auth-required","no-sma1000-appliance"],"how_to_check":"Check the SMA1000 appliance's firmware version against SonicWall's advisory: unknown\nReview administrator accounts and recent admin logins on the appliance: unknown\nCISA points to its Forensics Triage Requirements for investigation: unknown","fix":"Apply the SonicWall mitigation or firmware fix per vendor instructions and CISA BOD 26-04: unknown (affected and fixed versions not stated in sources)\nIf mitigations are unavailable, discontinue use of the product per CISA guidance.","status":"open","published_at":"2026-07-14T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:33:40+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T20:33:40Z","model":"claude-haiku-5-5","output":{"fix":"Apply the SonicWall mitigation or firmware fix per vendor instructions and CISA BOD 26-04: unknown (affected and fixed versions not stated in sources)\nIf mitigations are unavailable, discontinue use of the product per CISA guidance.","summary":"SonicWall SMA1000 appliances contain a code injection flaw that, under specific conditions, lets a remote attacker who is already authenticated as an administrator run arbitrary OS commands on the appliance. CISA lists it as known exploited in the wild and tagged ransomware-related.","category":"infrastructure","who_cares":["sonicwall","sma1000","vpn-gateway","self-hosted"],"confidence":0.7,"analyst_note":"Find affected and fixed SMA1000 versions, the specific trigger conditions, and the SonicWall advisory for CVE-2026-15410 (sources only link the CISA KEV search page); confirm the ransomware tag and whether exploitation requires admin credentials.","how_to_check":"Check the SMA1000 appliance's firmware version against SonicWall's advisory: unknown\nReview administrator accounts and recent admin logins on the appliance: unknown\nCISA points to its Forensics Triage Requirements for investigation: unknown","needs_analyst":true,"not_affected_if":["no-sma1000-appliance","auth-required"],"severity_if_unknown":"high"},"cost_usd":0.000464,"input_tokens":2228,"output_tokens":482,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':171C,197C,228C '-15410':18A,21A '-2026':17A,20A '26':170C,196C,227C 'accord':160C 'action':156C 'adher':224C 'administr':106B,148C 'alreadi':102B 'appli':157C 'applianc':86B,113B,130C 'appliances':24A 'applic':194C 'arbitrari':108B,151C 'asset':218C 'attack':99B,146C 'authent':3A,103B,145C 'base':175C 'bod':169C,195C,226C 'cisa':114B,154C,167C,184C 'cloud':200C 'code':9A,10A,89B,133C 'command':110B,153C 'complianc':165C 'condit':95B,139C 'contain':87B,131C 'control':5A 'could':140C 'cve':16A,19A 'discontinu':203C 'enabl':142C 'ensur':164C,223C 'evalu':216C 'execut':150C 'exploit':73B,119B 'exposur':221C 'firmware':27A,30A,33A,36A,39A,42A,45A,48A,51A,54A,57A,60A 'flaw':91B 'follow':193C 'forens':186C 'gateway':83B 'generat':7A 'guidanc':182C,198C 'guidelin':230C 'host':78B 'identifi':15A 'improp':4A 'infrastructur':74B 'inject':11A,90B,134C 'instruct':163C 'internet':220C 'known':118B 'let':96B 'list':115B 'mitig':158C,209C 'note':181C,192C 'os':109B,152C 'patch':229C 'post':2A 'post-authent':1A 'potenti':141C 'priorit':172C 'product':207C 'ransomwar':75B,126B 'ransomware-rel':125B 'relat':127B 'remot':98B,144C 'requir':155C,188C 'respons':214C 'risk':177C 'run':107B 'secur':173C 'see':178C,189C 'self':77B 'self-host':76B 'servic':201C 'sma1000':23A,79B,85B,129C 'sma6210':26A,29A,32A,35A,38A,41A 'sma7210':44A,47A,50A,53A,56A,59A 'sma8200v':62A,64A,66A,68A,70A,72A 'sonicwal':80B,84B,128C 'sonicwall':22A,25A,28A,31A,34A,37A,40A,43A,46A,49A,52A,55A,58A,61A,63A,65A,67A,69A,71A 'specif':94B,138C 'stakehold':212C 'tag':124B 'triag':187C 'unavail':211C 'updat':174C 'url':179C,190C 'use':204C 'vendor':162C 'vpn':82B 'vpn-gateway':81B 'vulner':12A,135C 'wild':122B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-07-14T00:00:00+00:00","kev":{"dateAdded":"2026-07-14","dueDate":"2026-07-17","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-15410","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-15410","severity":null,"published_at":"2026-07-14T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:21+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-15410","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15410","severity":null,"published_at":"2026-07-14T20:16:56+00:00","modified_at":"2026-07-16T05:16:18+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}